The present invention relates to local area networks, and wide area networks which consists of at least one local area network, for providing communication between computers and/or other network connected devices. The communication is based on well known communication rules, known as protocols (a set of rules) known to all parties participating in a session. A session is a conversation between two or more parties using a standard protocol. A party that initiates a session is called "client." A party that is connected to the client and accepts an invitation to join a session is called a "server." A session is always established by a client inviting one or more servers to attend. Additional clients may attend as well.
More particularly, the present invention relates to a method and means for restricting the access of specific clients to specific servers for specific protocols or data content. This is accomplished using a device located on the network and capable of passively listening to network traffic, analyzing it and responding to it when access is to be denied.
Presently, there are a number of solutions available for controlling communications over a network. One such controlling apparatus is a firewall. This is a machine located between an internal network and external networks connected thereto. The only way to communicate outside of the internal network is through the firewall. Therefore, a firewall is known as an active device that is managed for access control, and, in some cases, for authentication and encryption. By placing firewalls at strategic points between network segments, using routers, bridges and repeaters, it is possible to use this technology for access control between network stations located on different network segments. However, this solution is effectively limited, because a server station must reside on a different network segment than the communicating client station in order to monitor the communication. Internal intruders may install their own devices on the segment behind the firewall and thus get unlimited access to all machines inside the secured local area network. Also, because a firewall requires that all network traffic to pass through it and be processed for access control, the firewall causes a degradation in the throughput of the network. Accordingly, a firewall is also known as a network bottleneck.
Other methods for controlling communications over a network are various software products that implement secured protocols which include authentication. Using such software, the client identifies itself either directly or using an authentication trusted server, the server (in the communication) reciprocates by identifying itself as well. Using a pre defined security protocol, both parties either accept or deny the session. This requires both parties to use the same security protocol. This method also carries an implied trust in the authentication server when such a server is employed.
There is therefore a need for, and it would be highly advantageous to have, a passive network device that provides access control at a requested level over a local area network and a wide area network without using conventional software security and authentication methods.